KUBERNETES YAML FLAW COULD EXPOSE ENTIRE GCP ORG

Security researchers at Varonis have identified a critical privilege escalation path stemming from how Kubernetes Config Connector handles permissions. The connector grants broad authority to manage GCP resources, creating a gap between what individual Kubernetes users are permitted to do and what their actions can ultimately affect. An attacker with basic Kubernetes access could craft a malicious YAML file that, when processed by Config Connector, executes privileged GCP operations. Since the connector operates with elevated permissions in the underlying Google Cloud organization, it can perform actions the original user cannot. This confused deputy scenario allows the attacker to bypass normal permission boundaries. The vulnerability affects organizations using Kubernetes Config Connector without sufficiently restrictive role-based access controls. Varonis recommends implementing least-privilege principles for Config Connector deployments and auditing YAML file sources. Organizations should also monitor for suspicious resource modifications at the GCP organization level.